diff --git a/plugins/outputs/graylog/README.md b/plugins/outputs/graylog/README.md index d59602148..2b0475263 100644 --- a/plugins/outputs/graylog/README.md +++ b/plugins/outputs/graylog/README.md @@ -4,6 +4,23 @@ This plugin writes to a Graylog instance using the "[GELF][]" format. [GELF]: https://docs.graylog.org/en/3.1/pages/gelf.html#gelf-payload-specification +## GELF Fields + +The [GELF spec][] spec defines a number of specific fields in a GELF payload. +These fields may have specific requirements set by the spec and users of the +Graylog plugin need to follow these requirements or metrics may be rejected +due to invalid data. + +For example, the timestamp field defined in the GELF spec, is required to be +a UNIX timestamp. This output plugin will not modify or check the timestamp +field if one is present and send it as-is to Graylog. If the field is absent +then Telegraf will set the timestamp to the current time. + +Any field not defined by the spec will have an underscore (e.g. `_`) prefixed +to the field name. + +[GELF spec]: https://docs.graylog.org/docs/gelf#gelf-payload-specification + ## Configuration ```toml